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What is claimed is: 

1 . A method for exchanging information via a communications network. 

the method comprising: 

receiving, via the communications network, an information request from a 
data requestor, the information request requesting information controlled by a data 
controller, data elements relating to the requested information being stored in a data 
repository controlled by the data controller, the information request comprising a 
statement setting forth parameters relating to collection of the requested information 

by the data requestor; 

referencing a rule specifying parameters relating to permissible retrieval of a 

requested data element from the data repository in response to the Information 

request, the rule having been established for the data element by the data 

controller; 

if the collection parameters are in accord with the retrieval parameters, 
retrieving the data element from the data repository and using it in accordance with 
the information request; and 

if the collection parameters are not in accord with the retrieval parameters, 
responding to the information request with an offer to retrieve the data element for 
use in accordance with the rule. 



2. 
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parsing the information request to identify any data elements relating to the 
requested information, and to identify the statement setting forth the collection 
parameters; and 

comparing the collection parameters to the parameters of the rule to 
determine whether they are in accord. 

3. The method of claim 1 . wherein using the data element in accordance 
with the information request comprises using the data element to customize a 
display of information on a client device storing the data repository. 

4. The method of claim 1 . wherein using the data element in accordance 
with the information request comprises using the data element to derive the 
requested information according to a definition stored in a definitions database. 

5. The method of claim 1 . wherein using the data element in accordance 
with the information request comprises transmitting the data element via a 
communications network. 

6. The method of claim 5, wherein the data element is transmitted to the 
data requestor. 
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7. The method of claim 6. further comprising permitting the data 
controller to access data collected by the data requestor via a maintenance 
interface. 

8. The method of claim 7, further comprising permitting the data 
controller to modify any data collected by the data requestor via the maintenance 
interface. 

9. The method of claim 7. further comprising permitting the data 
controller to specify altemative parameters for data already collected by the data 
requestor via the maintenance interface. 

10. The method of claim 9. further comprising transmitting the altemative 
parameters for such data to any third party data requestors to which the data 
requestor has previously transmitted such data. 

1 1 . The method of claim 10, further comprising: 

storing a data receipt in a transaction log at the client device, the data receipt 
identifying the data requestor, the data element retrieved from the data repository, 
and the applicable parameters. 
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12. The method of claim 1 , wherein the requested information relates to an 
individual that is a data subject, and wherein the data controller is the data subject. 

1 3. A method for exchanging information via a communications network, 
the method comprising: 

a data requestor sending, via the communications network, an information 
request to a data controller, release of the requested information being controlled 
the data controller, a corresponding data element relating to the requested 
information being stored in a data repository controlled by the data controller, the 
information request including a declarative statement setting forth parameters 
relating to collection of the requested information by the data requestor; 

the data requestor receiving, via the communications network, a response to 
the Information request from the data controller, the response including the 
requested information; and 

the data requestor storing the requested information in a memory, the 
requested information being stored in association with parameters representing 
terms under which the data controller agreed to release the requested information to 
the data requestor. 

14. The method of claim 13. the response further comprising alternative 
parameters relating to collection of the requested information by the data requestor, 
the alternative parameters being in accord with a rule specifying parameters relating 
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to permissible retrieval of the data element from the data repository in response to 
the information request, the rule having been established for the data element by 
the data controller. 

1 5. The method of claim 14, wherein the alternative parameters are stored 
by the data requestor in the memory in association with the requested information. 

1 6. The method of claim 14, further comprising: 

the data requestor receiving a subsequent information request from a third 
party data requestor, the subsequent information request requesting information 
controlled by the data controller, the requested information being stored in the 
memory controlled by the data requestor; 

parsing the subsequent information request to identify information requested 
and a respective declarative statement setting forth parameters relating to collection 
of the requested information by the third party data requestor; 

comparing the collection parameters to the parameters stored by the data 
requestor in the memory in association with the requested information, the 
parameters relating to permissible retrieval of the requested information from the 
memory in response to the subsequent information request, the rule having been 
established by the data controller; 
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if the collection parameters are in accord with the parameters stored by the 
data requestor, retrieving the requested information from the memory and using it in 
accordance with the subsequent information request; and 

if the collection parameters are not in accord with the parameters stored by 
5 the data requestor, responding to the subsequent information request with an offer 
to retrieve the requested information for use in accordance with the parameters. 

1 7. A method for authenticating a request for information exchange, the 
method comprising and independent trust authority performing the steps of: 
10 reviewing a data requestor's information request, the information request 

relating to retrieval of a data element, the information request comprising a 
statement providing notice of the data element requested; 

comparing the statement of the data element requested to the data element 
or data elements requested for retrieval by the information requested; and 
1 5 authenticating the information request if the statement provides accurate 

notice of the data element or data elements requested. 

1 8. The method of claim 1 7. wherein the authenticating comprises 
applying a notice that the independent trust authority has authenticated the 
information request. 
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1 9. The method of claim 1 7, wherein the authenticating comprises 
applying a digital signature indicating authenticating by the independent trust 
authority. 

20. A method for exchange of information via a communications network, 
the method comprising the steps of: 

transmitting, to a data controller, an information request requesting 
information controlled stored in a data repository controlled by the data controller, 
the information request including proposed parameters relating to use of the 
requested Information; 

negotiating with the data controller, if necessary, to obtain agreement as to 
acceptable parameters relating to use of the requested information; 

receiving, from the data controller, the requested information; 

storing the requested information in association with the acceptable 
parameters relating to use of the requested information; and 

limiting use of the requested information to use in accordance with the 
acceptable parameters. 

21 . The method of claim 20, further comprising: 

permitting the data controller to subsequently alter the acceptable parameters 
stored by the data requestor, the method further comprising limiting future use of the 
requested information to use in accordance with the altered acceptable parameters. 
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22. The method of claim 20, further comprising: 

transmitting the requested information relating to the data subject to a third 
party data requestor only if the third party data requestor agrees to make use of the 
requested information in accordance with the acceptable parameters. 

5 23. The method of claim 20, wherein the negotiation is performed 

automatedly by at least one software-implemented negotiation engine. 



-50- 



